Skip to content

Commit c29100a

Browse files
committed
net: tls: fix returned read length with async decrypt
jira VULN-136507 cve-pre CVE-2025-39682 commit-author Jakub Kicinski <kuba@kernel.org> commit ac437a5 We double count async, non-zc rx data. The previous fix was lucky because if we fully zc async_copy_bytes is 0 so we add 0. Decrypted already has all the bytes we handled, in all cases. We don't have to adjust anything, delete the erroneous line. Fixes: 4d42cd6 ("tls: rx: fix return value for async crypto") Co-developed-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit ac437a5) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
1 parent 955a928 commit c29100a

File tree

1 file changed

+0
-1
lines changed

1 file changed

+0
-1
lines changed

net/tls/tls_sw.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2111,7 +2111,6 @@ int tls_sw_recvmsg(struct sock *sk,
21112111
else
21122112
err = process_rx_list(ctx, msg, &control, 0,
21132113
async_copy_bytes, is_peek);
2114-
decrypted += max(err, 0);
21152114
}
21162115

21172116
copied += decrypted;

0 commit comments

Comments
 (0)